NewsFortinet PSIRT
Improper access control on API endpoints
Teaser from the source
CVSSv3 Score: 9.8 An Improper Access Control vulnerability [CWE-284] in FortiAuthenticator may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. Revised on 2026-05-12 00:00:00
This is the RSS-feed teaser. Read the full article at the original source.
Read at Fortinet PSIRTMore on endpoints
Other advisories
- MediumCVE-2026-77061boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the local network can retrieve system log…
- MediumCVE-2026-77058boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin…
- Not ratedosv:CVE-2026-116485danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints
- MediumCVE-2026-115886MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
- MediumCVE-2026-115886MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
- Not ratedosv:CVE-2026-115886MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
- Not ratedosv:CVE-2026-55463Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation
- Not ratedosv:CVE-2026-57121PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API
Other news entries
- Fabric API Authentication bypassNewsFortinet PSIRT
- NCSC-2026-0412 [1.00] [M/H] Kwetsbaarheden verholpen in Splunk EnterpriseNewsNCSC-NL
- Reducing shadow IT visibility gaps with WazuhNewsBleepingComputer
- NCSC-2026-0340 [1.00] [M/H] Kwetsbaarheden verholpen in Aruba Networks ArubaOS-CXNewsNCSC-NL
- Securing Claude Code: The New Compliance API, Local Visibility, and Identity GovernanceNewsThe Hacker News
- AI Speeds Up Malware Development, Not Its Success Rate: AnalysisNewsSecurityWeek
- MLflow Vulnerability Exploited for Cloud Credential TheftNewsSecurityWeek
- Scans for Solana (Surfpool?) Endpoints, (Mon, Aug 10th)NewsSANS ISC Diary
Source: https://fortiguard.fortinet.com/psirt/FG-IR-26-128
ID